Bug: apm install --mcp without --transport fails with AttributeError

[stbenjam]

Description

apm install --mcp <registry-ref> without --transport fails with:

'str' object has no attribute 'get'

The code path expects the MCP dependency to be a dict (with .get()), but when a bare registry reference string is passed without --transport, it remains a str.

Reproduce

apm install --mcp io.github.github/github-mcp-server

Workaround

Specify --transport explicitly:

apm install --mcp io.github.github/github-mcp-server --transport stdio

Expected behavior

apm install --mcp <ref> should either infer a default transport or provide a clear error asking the user to specify one.

Affected versions

Observed on 0.10.0. Affects all targets (not Gemini-specific).

[github-actions]

Triage decision

accept

Proposed labels

theme/portability
area/cli
area/mcp-config
area/docs-site
type/bug
status/accepted
priority/high

Milestone

0.9.4

Suggested next action

Fix the str/dict type confusion in the --mcp argument handling path by inferring stdio as the default transport when --transport is omitted, and update docs/src/content/docs/reference/cli-commands.md to document the default.

Suggested issue comment

Thanks for the clear, reproducible report, @stbenjam -- this is a solid bug.

When `apm install --mcp <ref>` is invoked without `--transport`, the
code path that builds the MCP dependency config receives a bare string
and then calls `.get()` on it, which fails. The result is a raw Python
`AttributeError` that gives the user no actionable guidance -- that is
exactly the failure mode APM is supposed to prevent.

**Accepted as a `priority/high` bug targeting the 0.9.4 patch release.**

The intended fix is to infer `stdio` as the default transport when
`--transport` is omitted (matching the dominant MCP server deployment
pattern and eliminating the required-flag friction). A secondary
acceptable path -- if inference turns out to be unsafe in some
edge-case -- is to catch the condition early and surface a clean error:

    [x] Error: --transport is required for MCP dependencies.
        Example: apm install --mcp io.github.github/github-mcp-server --transport stdio

The implementing PR should also update the CLI reference
(`docs/src/content/docs/reference/cli-commands.md`) to document the
default.

If you would like to take a crack at the fix, that would be very
welcome -- the relevant code path is the `--mcp` argument handling in
the install command. Happy to review a PR.

Per-lens notes (collapsed)

DevX UX Expert -- User-Need Reviewer

Clear UX regression. apm install --mcp <ref> exposes a raw Python AttributeError: 'str' object has no attribute 'get' when --transport is omitted, violating the APM principle that failure modes must name what failed and offer a concrete next action. The preferred fix is to default to stdio (the dominant MCP transport), eliminating the required flag for the common case and matching the npm install <pkg> ergonomic APM commits to. A secondary acceptable path is a clean user-facing error naming the fix. Option A (default inference) is strongly preferred from a DX standpoint. Affects area/cli and area/mcp-config.

Supply Chain Security Expert -- Risk-Surface Reviewer

No risk-surface implication. The bug is in CLI argument handling before any package resolution or file writes. The fix does not touch lockfile integrity, signing, MCP trust validation, auth flows, or remote package resolution. Defaulting to stdio is the lower-risk transport choice (local process invocation vs. http/sse network endpoints). No theme/security or theme/governance label warranted.

OSS Growth Hacker -- Contributor-Tone Reviewer

Not activated -- stbenjam is an established CONTRIBUTOR with prior apm interactions; reply tone does not need first-timer calibration.

Python Architect -- Architecture Reviewer

Not activated -- the bug is a bounded str/dict type-confusion in argument handling with no cross-cutting design or interface implications; a narrow code-path fix is sufficient.

Doc Writer -- Documentation Reviewer

An implementing PR that adds default transport inference must update docs/src/content/docs/reference/cli-commands.md to document that --transport defaults to stdio when omitted. area/docs-site is added as a secondary area label to remind the implementing PR of this obligation. The issue body uses correct MCP vocabulary and needs no wording guidance.

APM CEO -- Triage Arbiter

Textbook accept with priority/high. A user-visible AttributeError crashing a documented install flow with no graceful error is exactly what patch releases are for. Design call is settled by precedent: CLI tools default the most common transport rather than requiring it; stdio is correct. Theme is theme/portability (cross-target MCP install ergonomics). Milestone is 0.9.4 (current open patch). Doc Writer's secondary area/docs-site label is warranted as a reminder to update the CLI reference when default inference lands.

{
  "decision": "accept",
  "decision_detail": "",
  "theme": "theme/portability",
  "areas": ["area/cli", "area/mcp-config", "area/docs-site"],
  "type": "type/bug",
  "status": "status/accepted",
  "priority": "priority/high",
  "preserved_labels": [],
  "milestone": "0.9.4",
  "next_action": "Fix the str/dict type confusion in the --mcp argument handling path by inferring stdio as the default transport when --transport is omitted, and update the CLI reference to document the default.",
  "comment_markdown": "Thanks for the clear, reproducible report, @stbenjam -- this is a solid bug.\n\nWhen `apm install --mcp <ref>` is invoked without `--transport`, the code path that builds the MCP dependency config receives a bare string and then calls `.get()` on it, which fails. The result is a raw Python `AttributeError` that gives the user no actionable guidance -- that is exactly the failure mode APM is supposed to prevent.\n\n**Accepted as a `priority/high` bug targeting the 0.9.4 patch release.**\n\nThe intended fix is to infer `stdio` as the default transport when `--transport` is omitted (matching the dominant MCP server deployment pattern and eliminating the required-flag friction). A secondary acceptable path -- if inference turns out to be unsafe in some edge-case -- is to catch the condition early and surface a clean error.\n\nThe implementing PR should also update the CLI reference (`docs/src/content/docs/reference/cli-commands.md`) to document the default.\n\nIf you would like to take a crack at the fix, that would be very welcome -- the relevant code path is the `--mcp` argument handling in the install command."
}

---

Triage status: agentic proposal pending human ratification.
Silence is approval. Maintainers can:

• Override any label or milestone above by editing it directly --
  human edits are authoritative and will not be reverted on
  subsequent runs.
• Re-trigger triage by applying the status/needs-triage label, or
  by removing status/triaged to enroll the issue in the next
  daily sweep.

Posted by the Triage Panel workflow. See .apm/skills/apm-triage-panel for the panel skill.

Generated by Triage Panel for issue #938 · ● 571.3K · ◷